Hacker Crackdown?

rombouts noted that Salon has a good piece on the liability of programmers. From Napster, to Freenet, to DeCSS, on down. If you're scared by any of this, you should be. There are a lot of cases out there right now that are gonna change the world, and folks, it could go either way.

Comments

Re:Why stop there?

[Upsilon]

I think you hit the nail right on the head there, but I think I'll generalize your point to reflect a certain belief I've had for a long time (watch out for the abuse of html tags):

Creating laws which cannot be universally enforced leads to arbitrary enforcement

OK, I'm kind of stating the obvious there, so I'll explain further. If we as a society create laws which have no hope of being enforced consistently because of the number of people already breaking these laws, then we are opening the doors to abuse by the government and police. We end up with a society in which everyone is guilty of something, but the only ones being punished are those who are disliked for some reason. The reason can be just about anything. You give the example of racism, which is a very good one, but is also unfortunately only the beginning. We could end up with a society in which a reporter uncovers some dirt about somebody in power, and ends up going to jail because of it. Sure, the reporter in question could never be directly prosecuted for uncovering dirt (hopefully, although the way our society is going...), but those in power might tell the police to go and arrest the reporter for a crime that everyone commits. This creates an atmosphere in which people are afraid of criticising their leaders. Unfortunately, we are already headed down that path. How many of you can honestly say that you never do anything illegal, and that if the police were watching you 24 hours a day they could find nothing to arrest you for?

Unfortunately, more and more laws are being made that can never (and should never) be effectively enforced. It's not part of a grand conspiracy, but the end result is the same. The reason is simply that the people are always screaming for the goverment to do something, but they never seem to care whether or not what the government did had any effect. They just want laws to "protect the children" and whatnot. But this doesn't simply result in a bunch of worthless laws that we can all laugh at and go home. It ends up creating an environment that is practically asking for government abuse. And abuse they do. And it's only getting worse...

Where do we draw the line?

[dsplat]

Which of the following can't be used to distribute pirated copyrighted data?

• ftp
• Apache
• nntp an your favorite newsreader
• E-mail clients and transport agents

An important question to ask is whether more piracy has been committed using Napster or Microsoft Outlook Express. Measure it in incidents or megabytes. How much copyrighted material has been e-mailed, posted to Usenet and posted on Web sites using Microsoft Outlook Express and read using it as well.

I want to be very clear about this. I am not criticizing Outlook Express. I also don't believe for a minute that Microsoft every intended it to be a piracy tool. Nor do I believe that Microsoft should be liable in any way for the fact that it can be used that way.

Any tool that allows us to publish any data can allow us to publish someone else's copyrighted data in violation of that copyright. Failing to hold the person who committed the violation liable and attacking the programmer who wrote the software instead is at best simply choosing a target of opportunity, who may have partial culpability. At worst, it is scapegoating and a search for deep pockets.

Re:The above comment missed the point

[KjetilK]

As for the soldier, well he really is just a link in the chain, since that's the way the military works. He just follows orders, he doesn't need to worry about them. He can't decide which are the "real" orders and to which ones he should say "That's immoral/unethical, I'm not going to do that".

No. That is exactly the attitude which makes crimes against humanity possible: "I was just following orders". It doesn't stand up. Each individual is responsible for his or her own actions. You know, this has been the main point of every trail on war-crimes since WWII, and indeed, you bet top nazis where convicted, while they were "just following orders". Why is this wrong? Because if you are willing to follow a lunatic on top, then you are contributing, because if you hadn't followed orders, it had never gone that far. You are all individuals! (No, don't give me that "I'm not!" :-) ).

As for the nuclear bomb, it was the scientists who should have stopped it, because only they could possibly be able to see the consequences of what they were up. Policymakers does not have the proper education to understand that, only the scientists.

As for technology in general, yes we do have a responsibility. As above, you can't just say you are a part of the chain, you will have to take responsibility for what you do. BTW, see Computer Professionals for Social Responsibility.

If designers of Napster designed it with the purpose of taking away somebody's rights, then, they must take responsibility for it. Ulrich felt that his right to decide how his music was to be distributed, and he has a point there. If Napster creators can convince people that there are more important concerns, then they must do it. It is still their responsibility, they can't run away from it.

In the case of DeCSS, I think the creators are assuming the responsibility for what they have done, and it is no small responsibility, it could prompt massive social change, and it is my firm belief, that it is social change for something good. It is not the DeCSS that should be illegal, but CSS. CSS was designed with the intention of taking away fundamental rights, notably the right for fair use. The creators are hiding behind copyright laws, not assuming the responsibility for something so bad they should have said "no, this stuff is not good, I won't make it". The same goes for a lot of things /. flame about, like spyware.

In conclusion, you must assume responsibility for what you do. Now, it is not ethically minded hackers that I'm most concerned about, it's all the coders who will do anything if you pay them big bucks.

Re:Guns and Programs

[FreeUser]

In fact, an even better example of how companies can be litigated against for what they do would be the cigarette company litigations that have won billion dollor settlements.

Well, the tabacco companies deliberately and knowingly increased nicotine content to maximize the addictiveness of their product, and added a known carcinogenic substance to improve flavor despite protests by their own scientists that doing so would kill even more people.

The reason the jury awarded such high damages was the willful and deliberate manipulation of the product to make it even more dangerous and harmful to consumers than it already was. It was not because people think tobacco should be illegal.

Put another way: it would not be a bad thing to put the tobacco companies who did these things out of business. Someone else could start a tobacco company with more ethical marketing and production policies (read: selling the natural substance, not doping it with more nicotine and additional carcinogens, and not marketing to children and young teens). Tobacco should not be illegal, but doping it with substances known to cause even more harm, and manipulating its addictive properties to make quitting physiologically more difficult should be -- and just like bars who abuse their liquor licenses, tobacco companies which abuse their priveleges should be shut down and put out of business.

What the tobacco companies did was heinous and unacceptable by just about any standard, and unless we want such irresponsible behavior to continue unabated it is important that they pay the full price for what they have done.

Accountability is good - and inevitable

[J.J.]

I'm disappointed in the Salon article. They typically do a decent job of getting things in perepective - but, as you've probably guessed from my expression of disappointment, I think they missed the boat this time.

I think this issue makes more sense when you divide it into two:

1. The growing trend of companies being held accountable for the use of their products.
   
2. The accountability of software authors
   

The salon article uses the industry that gave us guns, bombs, car and pantyhose as examples of product's creators being separated from the usage of their products. Their argument was valid five years ago, but today it's shot to hell:

• Cars: There's an entire industry based on car manufacturers determining whether a defect in one of their cars is worth the cost of a recall. Remember Fight Club? Edward Norton character's lawsuit price v. recall cost equation?
  
• Guns: In the past two years, lawsuits have sprung up in a number of major cities in America aganist the gun manufacturers themselves. They were insisting that the manufacturers didn't include the best safety controls, or that they provided a prolific number of guns down south, where gun laws are less strict, knowing full well that they'd trickle back north to the large cities. Read this and this. They're appaling!
  
• Tobacco: Do I even need to make an argument here? Big tobacco has been held accountable (to the tune of hundred of billions) for the actions of their customers, who knowingly smoked the cigarettes, even while being warned continously from a number of angles.
  

When you take a step back from our little microcosm and look at the rest of the world, you can see the growing trend of companies being held accountable for the usage of their products - either intended, in the case of tobacco, or unintended, as with the gun industry. The system is primed and ready to take poor Shawn Fanning and his little Napster upon the gallows for a good ol' public execution. Hanging might have gone the way of the Dodo, but the effect is going to be the same.

The second issue is accountability of software authors, specifically. Hey folks - if you've just been skimming, pay attention now and let me tell you something: Holding software authors accountable for their software is a good thing! (It's also inevitable, but you'll see that) I know I'll get flamed for saying that, but give me a second.

This discussion comes up on Slashdot about once a month. Folks gripe about companies paying the kid down the street to make them a web site, because the kid will do it for far cheaper than a real professional, and have similar results. But once the kid delivers, the company still doesn't have the product it was looking for. So then, they come to the professional.

There needs to be a way to differentiate between you, the professional software engineer, and the kid next door. Sure, you can get MCSE, CNA and a whole slew of other acronyms after your name, but that's not working. Every other engineering discipline has a certification exam that allows you to personally ceritfy yourself as a Professional. Once you're a Professional Engineer, you're held responsible for your work. Civil Engineers are held liable for their bridges, Mechanical Engineers for their machines, and it's a Good Thing. It forces the engineers to hold to their design process and keep the level of quality high.

Every software engineering text that I've read supports this trend towards accountability. The process of creating large software products is slowly becoming more and more of a formalized process. Formal procedures are good, because software design is inherently a very difficult process to make step-by-step. Changing requirements, ignorant customers, bad technology, they all work aganist you. This formal specification of the software design process creates accountability, in the form of Software Requirement Specifications (SRS). A contract, between the company and the customer, outlining the expectations of the new piece of software. The beginning is there.

Companies are going to be held liable for their products. That's inevitable, given the larger trend in our system. But is it fair to hold a kid, be it the DeCSS kid or the Napster kid liable for making public the result of their late-night tinkering? I don't agree, but then, I've got the perspective of the tech-savvy.

Napster probably will be shut down. Shawn Fanning probably will held accountable. We're liable to see a veritable witch-hunt begin over the course of the next couple years as a result. But, in the end, the legal system as well as the software authoring world will be a more mature place. Will a formal system of accountability get set in place? (shrug) The ball is rolling. Which direction it takes down the hill, and what bumps it'll hit are unknowns. But it is rolling.

Something about a handbasket...

[JCMay]

It's a sign of the times. We're a nation- no a world of victims. We are not responsible for anything, and we spend our energies looking for an easy out: how can I profit from somebody else's work?

This whole idea of coder responsibility for others' use of software is merely the latest power grab by these whiners. I'm so glad I don't live in Atlanta any more, where gun makers are under threat of suit for people shooting each other. I just have to shake my head. What's wrong with sending the shooters to jail? Oh, yeah. It's their wretched childhood that made them do it.

Here in Florida, smokers are getting paid to smoke. No. Really. Long-time smokers, people that have been smoking since the European explorers came here and found the natives burning leaves and inhaling the combustion products, are suing the companies that provided them with the instruments of their chosen leisure activity because "we didn't know it'd make us sick!" Baloney. It's common knowledge that smoking will make you sick, and even kill you. But cigarettes and tobacco products are legal. There are warning messages in all advertising. On even the packaging of the products! In newspaper articles and medical research reports. These people have no excuse, other than themselves, for their continued smoking. Yet we find ourselves in the midst of an amost trillion dollar settlement.

About ten years ago, people clammored for air bags in cars. The automakers were reluctant; air bags were a relatively unknown quantity, even though conceptually they held much promise. The Government, out to save us all from ourselves, stepped in. A law was passed mandating air bags in vehicles. Soon after, accidents starting happening where children were hurt or killed by these "life-saving" air bags. Now people are clammoring for "slow-deploying" or switchable air bags. Tell me, if air bags become switchable, how long is it going to take before the first law suit is filed claiming that so-and-so was killed because their air bag was turned off? How negligent of the auto maker to allow car owners the option of turning off safety equipment!

Even before air bags was the seat belt. Cars didn't come with them standard originally. But about 40 years ago books were written and lawsuits came about that end the end meant that every car on the road had seat belts. Cars cost a little more, but hey, now they were safe. Except nobody would use them (well, I like seat belts-- keep me from sliding around :) So fifteen or so years ago, the Government stepped in, and a law was passed requiring seat belt use. Whew! Now we are safe in our cars.

Unless you drive a small car. Ten you are in danger from those of us that choose to drive our urban tanks (personally, I drive a 1995 Firebird). Your chinzy little car may get dramatically better gas milage, may be easier to drive and park, and even cost less. But get in a scrap with your neighbor's Suburban, and you're toast. Tell me, what do you think: Should he not be allowed to have his Geo-Eater, or should you be required to buy a Urban-Sherman?

In each of these cases the Government has stepped in, and in each case we've been told that we're too dumb to live our own lives making our own decisions. It used to be that a boy became a "man" early in his teenage years. Later it was put off 'till his eighteenth birthday. Afterwards, 21, because "men" could drink. Today, I think that about age 83 is right for becoming a "man." Before age 83, we're too dumb and inexperienced to handle our own lives.

We, as a group, want to be coddled. We've come to live in Neverland, and it's populated with nothing but an army of Peter Pans. We never grow up, we never take responsibility.

It's stupid and I resent it.

Jeff

Why stop there?

[HiQ]

They should go after the guy who invented TCP/IP... No wait, get the guy who first thought of networking... No wait, the guy who first thought of computers, he is definately the guilty one!

*Sigh*

How to make a sig
without having an idea

Re:Why stop there?

[laborit]

But there's the problem... they clearly will stop somewhere, even if the law doesn't make it clear why they should.

An Oklahoma law makes it illegal to possess anything that looks like an illegal drug. Clearly Oklahoma's finest don't spend all their time kicking down kitchen doors and putting people away for having powdered sugar, oregano, or water. But in 1998 they did throw George Singleton in jail for a month, even though he was able to prove that he made his living as an herb merchant and that the plants filling his car were rosemary and mullein, two legal plants that he grew to treat asthma (and which, incidentally, don't look at all like marijuana).

Anyone want to guess what color Singleton's skin was?

Making (e.g.) Clarke liable for Freenet would be disastrous. It would put us in a state where most coders and inventors would be legally liable for something, but few would ever be prosecuted. This would give the government vast latitude to punish anyone they disliked, under a legitimate but overly broad blanket -- kind of like prohibition, in which everyone drank but only undesirables got busted.

- Michael Cohn

Re:Why stop there?

[gotan]

One problem is, that the internet fundamentally changed some things, especially in the case of software. One thing is, that software is easy to use, once it's in your computer you can run it, and nowadays there's a lot of computers. It's not like some description how to make an atomic bomb because creating an atomic bomb is a lengthy expensive process, getting the right materials is only the start.

The other thing is the internet, spreading files blindingly fast aound the globe, once the thing is out of the bag and there's enough people interested in it, word will get around in a couple of weeks, together with the software. Something like gnutella is an ideal example: the internet can't be rid of it now that it's widely distributed, and it can be used with very little effort.

So while before big corporations could face down their 'problems' by keeping them local and by introducing new technologies before something was widespread enough to affect their income this is no longer the case. Before it was more like squishing ants: if joe normal choose to copy and sell music the company holding the copyright could beat him up pretty nicely in court and then proceed to hold him up as a bad example (or keep silent about the case if it ended unfavorable).
But now all those ants are darned fast, hard to localize and hit (try to make a big case of someone trading one musicfile), there's a lot of them and they're all attacking (their revenues) at once.

Naturally the companies are looking for new targets to strike at, and what better target is there than a single programmer, preferably without enough money to go through all those courts before going broke. Minimum effort for maximum effect: hit one little guy scare a million others (in that case the fast, information spreading internet even works for them).

But there's still hope: even the big business can't bring down the internet (especially without hurting themselves more than anyone else) and programs like gnutella and DeCSS will still surface and spread (maybe a little later than before) it will just become harder to track the sources down.

One good start for this is involving more people in the process (maybe working in some forum to cobble together a nice protocol (e.g. for filesharing)), implement it in source projects, and if possible make general purpose tools (filesharing and anonymity have other purposes than just distributing MP3's).

Re:Why stop there?

[Veteran]

Profound observations. I would like to expand on them a little: there are already so many laws that even a lawyer can't know what all of them are. If you can't even know what all the laws are, how can you be legally responsible for obeying them?

Of course, the Prosecutors of the world would say "Ignorance of the law is no excuse" and I would continue "because if it were we would have to have a reasonable system that anyone could understand, and that might work - so we can't have that, otherwise we couldn't push people around, and we wouldn't like that."

The world is a screwed up place because there are people who want it that way.

Remember the bullies you ran into in school? Did you ever wonder what became of them when they grew up? The answer is that they never did grow up, they just figured out how to get away with bullying people; if you'll check, you'll discover that most of them went into law enforcement.

One thing which Ayn Rand got correct is her description of a "Conspiracy of Cockroaches". The law is an example of one; there is no formal conspiracy, there are just lots of like minded people who are seeking the same ends.

People can be divided into two broad emotional groups, the emotional 'herbivores' - who just want to be left alone to 'chew the cud of their happiness' and the emotional 'carnivores', who want to 'eat other people's happiness'.

The law is a great deal like the lions going to the wildebeests and saying to them "We notice you have a problem with wildebeests getting out of line. Why don't you let us handle the animals that get out of line? We'll make sure that everyone stays in line; we'll punish the ones who stray." And the wildebeests GO FOR IT.

Most people are emotionally 'herbivorous', most lawyers are emotional 'carnivores', we are absolute fools for letting the 'carnivores' set up the legal system.

The law, 100's of millions of lines of code, not one line of which has ever been tested to see if it works.

Re:Why stop there?

[ScuzzMonkey]

And to follow up these two already excellent points, here is another observation: The American system of government inevitably results in a glut of legal code. Why? Because being a legislator is a full-time job. We keep electing all these people and putting them in office for x number of years with a job description that basically says 'Pass laws.' And because they need to be seen, for the next election, as having done their job, they come up with all kinds of ridiculous, complex, and over-focused codes to put on the books. Take a look at what's on the docket for this Congress sometime: http://thomas.loc.gov/home/c106bills.html There are more than 5000 bills listed for the House alone. Go in; pick a few at random. How much of it looks useful to you? Think you could remember all of it to make sure you're not violating any Federal laws next time you leave the house? Multiply that by past congressional sessions and then add in whatever your state and local legislators have been up to (which will be the majority of what concerns you anyway). This will happen every year for the rest of your life. It's not just that there are some people out there who want to make things complicated for their own benefit--the system itself will inadvertently make things complicated, even with the best intentions. This was not as much of a problem when it was designed; if you had to travel for a month just to assemble the legislature, and then get home to supervise the harvest, you tended to get to the important business at hand and leave the fluff aside. But today, legislative sessions last longer then ever, and under the constant eye of the media, legislators put in long hours coming up with complicated ways to impress special interest groups and their constituencies. And it will only get worse.

Time to Say Something

[DeICQLady]

Other than the question of the extent of a programmers liability, another point the article brought up that I thought important was "Unless technologists take a leading role in shaping the legal debate, says Jennifer Granick, a San Francisco lawyer who regularly defends people accused of computer crimes, Oppenheimer's legacy of freedom could be lost."

Not only will that leagacy be lost, we will stand by and watch a group of people, some of which have relatively little knowledge of how our "baby" (the industry) works, molding it and creating it into what they are used to and are familiar with. The scary thing about that is we have never been exposed to such bombardments and tests on defining or having to redefine copyright or amendment rights et al., therefore we run a grave risk of never having legislature evolve to encapsulate our new ways of communicating, sharing ideas and innovationg.

I think what we should do is treat this whole phase of redefinement (sp?) and growth like Linux: if there is something you don't like and | or you think it can be done better, make an effort to say something that will only benefit us in the long run, and reduce chances of implementing *permanent solutions* (ahem, law) that sucks the innovation and enthusiasm out of our baby. (The engineers, scientist and techs will get left out and the marketing and finance people and lawyers make all the money!)


Nuff Respec'

DeICQLady
7D3 CPE

Read the Risks Forum

[goingware]

I say this all the time here, I think it is important. It is very pertinent to programmer liability (although more from a safety or cost of failure perspective) - read the Forum on Risks to the Public in Computers and Related Systems. It is also available on the Usenet News as comp.risks.

If you think programmers can really escape liability for their products (or should), think about what kind of effort and investment companies like the tobacco industry and auto manufacturers of automobiles and childrens toys and food put into defending themselves from lawsuits and government regulation.

It's only a matter of time before the public rises up and demands accountability for software. Imagine a senator getting elected on the platform of promising to put programmers behind bars for writing software that is unreliable. Or a district attorney setting out to put programmers behind bars, not for hacking or writing viruses, but for writing products that don't meet government standards.

I haven't read it yet, but the Software Conspiracy looks interesting.

A problem; a solution.

[Greg@RageNet]

A problem

Unfortuantely american society (among others) is leaning in a direction where the individual is no longer accountable for their actions. Liability for individual's actions are being shifted to product manufacturers. This is mostly thanks to lawyers and greedy americans who think they can get the 'big score' by suing large corporations. Additionally large corporations use lawyers and litigation to intimidate individuals out of behavior that while technically legal is contrary to the way corporations believe things should be done.


You aren't responsible when you spill coffee on yourself, McDonalds is.

You aren't responsible when you get a terminal desease for using a product you knew was unsafe for twenty years, Philip Morris is.

You aren't responsbile when you shoot someone while mugging them, Smith and Wesson is.

You aren't responsible when you pirate music, Napster is.


The terrible end result of this strategy is that your individual rights and fredoms are stripped from you by government because you keep proving time and again that you do not want to be responsible to weild these rights. Government turns into a big babysitter.

Thats the big picture; damn sad where we are going. But to focus on what you can do today to protect yourself:

A solution

Anyone who is considering doing something that may draw the wrath of lawyers should consider incorporating. Incorporation provides protection to those who work for corporation so that these people are not fiscally liable for the actions of the corporation. Thus if you write something somebody does not like and you sign all rights to this code over to your corporation (and licensing this code out with GPL or equiv). Then when the lawsuit comes they can only go after whatever assets your corporation holds, rather than your personal assets.

Incorporating is fairly simple, and involves either some research on your part or paying a lawyer to get things moving. I'd say you probably won't be set back more than $1000, and probably around $150/yr to maintain it (could be more depending on which state you incorporate in and how much research and accounting you do yourself).

It's cheap insurance if you anticipate legal threats. One caveat is to ensure you act within your corporation's framework; if you do things that blurs the line between you 'the corporation' and you 'the individual' you could become personally liable again.

-- Greg

IANAL, so go seek one's advice if you'd like to learn more about incorporating and liability.

Re:The above comment missed the point

[Detritus]

As for the soldier, well he really is just a link in the chain, since that's the way the military works. He just follows orders, he doesn't need to worry about them. He can't decide which are the "real" orders and to which ones he should say "That's immoral/unethical, I'm not going to do that". And yes, this IS straight out of "A Few Good Men".

A soldier has a duty to disobey an illegal order. That is the policy of the U.S. Army and it is International Law. That is what I was taught when I was a soldier. You can be court-martialed and convicted for carrying out an illegal order.

A dangerous path

[Sanity]

If this type of thing is permitted to continue then we risk creating a society where, instead of rewarding creativity, it is demonised. And why? So that those who lack the wit to adapt don't have to.

Ian Clarke.

--

Re:Hence: hacker-speak

[KahunaBurger]

My previous example was indeed a bad one, so I will make a better one. A user creates a web-page of file aliases. He then posts random_file_00416.mp3, adds 5-10s of buffer whitespace to throw off file size checkers, and lists on the webpage that random_file_00416 is indeed a metallica mp3. Once again, the actual name means nothing. Give it a little more time, and a Napster client clone might even incorporate such alising and make it transparent.

Thank you, this is a different issue and somewhat more relevant. The first question seemed to be "What if the filters accidentally block 'legitamate' content?" Which seemed to me to actually be deliberately misleading content, and thus not legitamate. The second question is "what about people getting arround the filter to still post illegitamate content?" The answer is the three simple words that make or break a company in terms of liability :

GOOD FAITH EFFORT

Contrary to what some Napster supporters would have you believe, they do not need to prevent anyone from ever using their product or service for piracy. What they must do is make a good faith effort at prevention and reduce the piracy use. Instead, they seemed to do everything they could to encourage illegitimate use of the service as part of their business model. This is why they're in trouble. (Its also why the Salon article was so silly, but thats another part of the thread.)

A service of that size can't reasonably be required to verify more than the filename or link name within their web page or servers.

Very true, though they could also de-annonymize it to the extent that when illegitamate use is demonstrated they can kick the violaters off and have it mean something. But those efforts combined would show enough good faith to get them mostly out of the hot water they've dunked themselves in, even if it doesn't eliminate all illegitimate use.

The liability world is all about good faith efforts. This is why an anti-harrassment program will reduce a company's liability if harrassment does occurs. Its not useful to ask "can they ever stop all illegitimate use of their service?" You have to ask "Are they making a good faith effort to reduce such use?" On this point Napster fails, and if we focus on that failure we can make sure that an artist centered venture suceeds.

IMHO, it is the Napster advocates who are endangering the use of the net as a promotional tool for unsigned artists. By claiming that Napster cannot prevent illegitimate use, they are handing the RIAA the amuntion it would need to shut down a service meant to promote artists (who want to be promoted). After all "even advocates of on-line music admit that nothing can be done to prevent infringing use of such a service". If we focus instead on good faith efforts, it leaves Napster screwed (which they are anyway) but leaves the door open for legitimate ventures to promote music on the net. Just a thought.

Kahuna Burger

Accountable for its quality yes, for it's uses no.

[{LF}Ceres]

I have no problem with being accountable for the quality of the software that one distributes, and i think when u refer to the software engineering text that "supports this trend towards accountability", i think they are refering to the software makers being accountable for quality, and not making software makers accountable for it's uses. There is a world of difference between the two. To use the examples that you gave:

Civil Engineers are held liable for their bridges

... if they bridge falls down.. yes, but what if someone is driving drunk and drives off the bridge and dies? Is the engineer responsible?

Mechanical Engineers for their machines

Someone uses a car to get away after robbing a bank, is the mechanical engineer that designed the car responsible for the robbers getting away?

Anyway, you get the idea. There are many things to be accountable for, and when using that word it's important to remember that. In the case of an author being accountable for a piece of software it's as ludicrous(sp?) as the examples i gave above.

Ceres

Dear Bill Joy

[Hobbex]

Dear Bill Joy,

As one of the head programmers of Freenet, I would like to take this opportunity to thank you for making it possible. If we had not had your programming language, Java, and your editor, vi, I doubt we would ever have been able to get an implementation of Freenet working. You made it happen.

Since you must have known that people would one day use your programs to write programs that people could use to avoid censorship laws, you would obviously not have written them if that is not what you wanted, and I'm glad you take responsiblity for it. I hope we will have plenty of time to discuss how the people should be controlled so that they don't learn how to do bad things while in our shared jail cell.

Sincerely, Oskar Sandberg.

(And since you asked CmdrTaco, no I'm not scared. Are we men or are we mice people?)

Re:Napster Injuction

[VAXman]

Since you didn't read the judge's decision, the method she suggested for preventing piracy was to create a registry of songs whose authors have given permission for them to to be distributed for free on Napster, and every transfer would be checked against this. If it didn't appear on the registry, it would refuse transfer. Note that "this is not a metallica song" would not be registered since it's authors did not register it. If you write, perform, and produce such a song, then you can add it to the registry to be traded.

This would be trivial for Napster to do, and there are other methods Napster could use to achieve this. The fact that they don't prevent piracy when they have such easy technical means to do so (as opposed to guns, which the companies have no control over after they are purchased) is the reason why every lawyer on the planet thinks that they will be shut down.

not to sound like a militia......

[umask077]

First, apologies to non us readers, I refrence the US as ours only because of ease and the fact that most of the readers here are US citizens. Isnt it about time we solve the problem by ousting our current goverment? The constitution garuntees us the right to do it. Are we just to lazy? We are losing this battle against the legal systems and the corperates on every front, napster, decss, sites being shutdown cause they say stuff corperate lawyers dont like. IMHO there are more of us then there are of then. We are yielding to a moral minority. We have tried it there way. But we are the majority. Is it we fear the military reprucusions? Most of them are 17-25 years old and spend there spare time on napster too. I dont even use napster myself but Im sick of seeing the corperate world pushing people around. I think its time to replace our existing goverment with something better. Time to get rid of some the lawyers who block lifes progress. If you just look at the tax system which is far to complex for anyone to figure out it shows it needs replacement. Running a goverment isnt as challenging as they make it out to be. The only reason it is at all challenging is all the lawyers. Its time for change. Lets get rid of the old in favor of the new. I stopped using my 386 and bought a new machine when it became obsolete. Hell, my pentium 90 went obsolete so I upgraded again. Goverment shouldnt be made an exception to the upgrade process. If its obsolete throw it away and get something that does the job. Our goverment is obviosly obsolete.

What about the music *product*?

[ScottyB]

Does anyone else here see the least bit of hypocrisy in that the RIAA/MPAA are trying to make producers liable for the actions of users?

What about the "free expression" rights always demanded by movie and music makers, so-called artists who are making media even more sensational, whether through violence or sex, simply to increase profits? Popular culture (not art, mind you, since that is not a product like popular culture is) has been defended on the grounds of free expression for years, but it is a product and is in many ways responsible for the sensational reactions that viewers (i.e., users) have.

The way I see it is this:
(0) If code is seen as protected speech, then we should be in the clear.
(1) If code is not defined as speech, then coders are in trouble since computer code will be a product and thus the producers, programmers, will be liable.
(2) If code is speech, then it might not simply be protected speech. In this case, the case needs to be made that code is information, and that if the producers are still to be held liable, then producers of other information sold as products, like musicians (see here for my arguments on music as information), should be held similarly liable, or vice versa.

I personally think code is protected speech; that it can be useful as a tool only occurs if you have a compiler. I would agree that, especially when money is not being made off of it (i.e., somewhat different from Napster's case), code should be considered like an art form, deserving free expression rights.

The bottom line, though, is that coders need to get vocal, and not just on discussion forums. Write the mainstream press, CNN, the Washington Post, the New York Times, with letters to the editor; write something that outlines your positions in ways others will understand. Heck, I'll post it on DigitalRenegades. Just SAY something that others will hear.

Though it may sometimes not seem that the US is a democracy, it is. And lawmakers always want to keep their jobs by getting your vote.

SB

Editor, DigitalRenegades

This is just so wrong...

[fraserspeirs]

All these cases are just knee jerk reactions. Like the Salon article says, nobody has actually decided on a concrete definition of what software is, so were're seeing them take each case on its merits or demerits.

I find it completely bizzare that technology is now seen as inherently good or evil, not neutral. It seems that it is Napster itself that is bad, not the actions of it's users who download copyrighted MP3.

How come we have double tape decks? Surely that encourages copying? Maybe it's easier to shut down Napster than it is to criminalize millions of users then try to prosecute each one.

why?

[macpeep]

I'm probably missing something here so please answer my question:

If I write a piece of software which sole (or biggest) purpose is to help other people engage in illegal activities then why should I not be as liable for it as a drug dealer is for the drugs he sells?

Bad quality (bugs) software is one thing and is merely a question of quality tolerance. Writing crime-assisting software is quite another.

Re:why?

[HiQ]

Well, when is a drug a drug??

You can buy glue in a store, that helps you glue things together; but you can also take a nice deep sniff of it, and float quietly away, mmmKay? Same goes for software; you can program nmap to check for weak spots in your network, but you can use this tool for good and for bad.

All in all, your question is not so easy to answer; unfortunately, the worlds isn't so black and white, it also comes in different shades of gray

How to make a sig
without having an idea

Re:why?

[delmoi]

Hrm... you don't sound like a troll

If I write a piece of software which sole (or biggest) purpose is to help other people engage in illegal activities then why should I not be as liable for it as a drug dealer is for the drugs he sells?

How is writing software like selling drugs? Holding software authors liable for the criminal activities of others would be like holding hypodermic needle makers liable for people injecting heroin. Hypodermic needles can be used to inject anything, just like Napster can be used to transfer any audio recording (or other file, with a bit of hacking) and DeCSS can be used to decrypt DVDs for lawful purposes.

While a tool can be used for illegal purposes, the illegal acts are not the responsibility of the toolmaker, but rather the actor. The kid trading Metallica over napster is the drug-dealer, not the guy who coded it.

US != World

[bartok]

Hum, hum I don't mean to be a troll gere but the rest of the planet keeps turning when something bad happens in the US. Americans have this anoying tendency to think that everyone want to be like them. Not that being an American is a bad thing but.. I guess most smart people have gotten my point..

The difference

[Hard_Code]

You make some valid points. Yes, creators of products (or services) cannot be entirely seperated from the results of usage of said products or services. But in the examples you cite, the products do EXACTLY what they were meant to do. Cheaply made cars break and kill people, well, because they weren't designed not to. Driving a car is not some strange and bizarre activity - in fact it is the activity the car was designed for. Tobacco also was designed (don't even try to tell me otherwise) to deliver a neurostimulant. Inherent to the fact of being a smoked neurostimulant follow many consequences. I think guns are a bit different because they are not failing to perform in the advertised manner or producing unwarrented results (when you shoot something it will get hurt - duh). Guns do exactly what they are supposed to (and what they're supposed to do is the issue, not the metal and wood of a gun).

However, nobody is complaining that the product in question has bad side effects when *used correctly*. Nobody is being hit by shrapnel, or inhaling second hand smoke when they trade files. What is being claimed is that because some people choose to use an entirely valid product for a criminal purpose, the creator of said product, who may have nothing to do with this person, or even the product itself at this time, can be held responsible. Bombs and guns are not a good analogy - because they do *exactly* what they're supposed to do. A file sharing network is for sharing files, agnostic of their legitimacy or value. If somebody is using this service/product criminally it's not the creator's fault. E.g., are car companies responsible for bank heists or drug trafficking? Their responsible for cars breaking down or blowing up, but not for somebody doing something illegal with them.

does that make sense...

Accountability? Yeah, right!!

[smallstepforman]

Society should stop grinding axes and focus on educating people, since all problems which exist today stem from a lack of understanding. Beer manufacturers should not be held accountable for alchohol related accidents - drivers should be aware of how alchohol impedes judgement. The poor peasants in Serbia shouldn't be bombed for the insanity of one man - the west should encourage the citizens to seek a wealthier life. Software engineers should not be held accountable for a bug which causes an orbital rocket to deviate from its course and slam into a crowded school - management must allow adequate time for testing. Etc Etc.

Alarmism.

[AndrewD]

Even with the unpleasant US laws on copyright and so on, I think salon are over-egging this one (and IAAL, but NAUSQL; mileage may vary from the US Bar). Look at a few examples:

1. Napster provided a centralised service - their search engine - and that's what is being shut down; the trading of MP3s through less formal channels isn't being touched.
2. The DeCSS action is about to founder on the First Amendment. The source code is very, very likely to be held to be protected speech.
3. PGP got around the export restriction by publishing the source as a book: the protected speech could then be exported without restriction and OCR'd, rebuilt and used.

In fine, the author of a piece of source code is OK. If he does something with it that is not protected, he's potentially in trouble. If he provides some other service that's an infringement of something or other, he's potentially in trouble.

That's what Napster ran aground on: the injunction (which won't get stayed by the Appeal, according to a US attorney friend of mine) was against the inclusion of copyrighted material in their searchable database of traded MP3s, not against the non-infringing uses of the software or in respect of anything the users did.

The injunction ordered Napster to do something they had previously declined to do: exercise some discrimination in the material they included in their list of tradeable MP3 files. Nothing to do with their authorship of any software.

The Oppenheimer defence is available only where you have no control over the end use of the product and there is a substantial lawful end use of same and the product is not dangerous in normal use if it is meant to be safe. (This is a statement of general principle, incidentally: for the specific application in your local jurisdiction consult a lawyer qualified to practise where you are).

Oppenheimer himself had no control over the end use, and that end use was (in the context of a major war) lawful. The product was dangerous in normal use, but then bombs are meant to be.

Big Tobacco is OK all the way up to the danger point. They've been insisting that the product was safe for decades, and now that is coming home to roost. (If they'd sold it, from when they first figured it out, on the basis that "this stuff will kill you: don't say you weren't warned that a little pleasure now will be paid for with a lot of pain later" they'd have been watertight)

DeCSS is perfectly safe to use, and there is a substantial lawful use (at least, lawful everywhere but the US) for a finished product (an executable). The source code itself doesn't do anything but communicate, so it's protected speech. The authors can't otherwise control what's done with it.

Napster, on the other hand, is used almost exclusively (on the evidence in that case, and on Napster's own business plan) for copyright infringement, and Napster run their marketplace as a centralised service so they've got a clear control over what's done with it. It is this last that caught them by the main zipper; it is this that's going to make their eyes water.

Laws

[Ayon Rantz]

It seems to me that the problem we're facing is too much legislation. Maybe it's time we started rewriting the laws from scratch?

A good starting point would be:

Do what thou wilt shall be the whole of the law.
- Aleister Crowley

Why should programmers be silenced for following their True will? Science is already bogged down and stupidified through the master-servant systems incorporated in all major corporations, the education system and politics.

Communication is only possible between equals
- Robert Anton Wilson

If you have to go through the burden of bureaucracy, or resort to lying to your superiors because you know your real thoughts might get you fired or failed, you're already losing control over your own creativity.

Controversial or subversive material such as Socrates' philosophies, the research and books of Wilhelm Reich, or Napster, will always be suppressed by the powers that Be because of fear of the Unknown. The majority of the general public will be fooled all the time. Lawsuits and threats of financial incapacitation have just replaced the poison cup or the burning of books as the establishments instrument of oppression.

Maybe it's time to realise that electorial democracy is just another words for a self-imposed dictatorial oligarchy?
--

software liability all of a sudden?

[jetson123]

So, if some company sells me a lousy piece of software that causes me to lose money, I can't sue them, because under UCITA they have absolved themselves of all responsibility.

But if I write a piece of software that can be used for file swapping and someone uses it to commit copyright infringement, I may be held responsible for contributory infringement by the RIAA and MPAA?

Even the language and analogy itself is disturbing: creating tools for letting people share information is now on the same level as creating nuclear bombs? Isn't the ability to communicate freely at the heart of a democracy?

I think it's pretty clear what the deciding factor is in who can and cannot be held responsible for the software they create: people with money and political influence are exempted from responsibility. Remember that next time you vote and give the third party candidates a chance. Nader is looking pretty good...

The above comment missed the point

[Crag]

The article refers to making programmers accountable for the ways their software is used against other people, not for how good the software is. This is very different from the liability the automobile and tobacco companies are fighting. This is more like the lawsuits being pressed against the gun makers.

That being said, this concept (programmer is responsible for how his program is used) is ludicrous. While it is important for people to be aware of the potential uses of their creations, the leaders who gave the orders to drop the atomic bomb are to blame, not the scientists who designed it or the works who built it.

This issue is very complex. There is a lot of energy at stake, and a lot of confusion about what can and what "should" be done. The only sure way to solve all these problems once and for all is to hold the final decision makers responsible for _their_ actions. If you are holding a gun, only use it in self defense or for sport. While driving a car, respect the power of 2000 pounds of steal going 70+ mph. While holding a baseball bat, don't blame the manufacturer if you decide to hit someone with it.

No matter what power you hold, there is noone better qualified to keep you from abusing that power than you.

Blaming doesn't get us anywhere. The change we want is much deeper than making it more difficult to cause harm. We need to stop wanting to cause harm.

(We also need to agree on what harm is - napster is certainly a grey area in many peoples' minds.)

Re:The above comment missed the point

[DrWiggy]

While it is important for people to be aware of the potential uses of their creations, the leaders
who gave the orders to drop the atomic bomb are to blame, not the scientists who designed it or the works who built it.

There is a story I can tell here that links the software creativity "conundrum" and the very example you've just given. I used to know a guy who went to join the RAF as a trainee Pilot. In his interview they asked him how we would react if he were given the order to press the button to drop a bomb on a small village, and whether he would have any moral or ethical hangups over it. The answer he gave was that he was just part of a chain - he could not and would not take the sole responsibility for the dropping of that bomb as the ability for him to do so was shared amongst the scientists who created it, the commanders who ordered the bombing, even the woman who cooked him his eggs that morning in the canteen.

In many ways it's exactly the same with software. If I write a piece of code that could be used maliciously (depending on what your definition of malicious is), am I really that responsible for it's use if there are other people who market that code, or who themselves take the source and adapt it so that it is even more malicious? In fact, would my parents not also be responsilbe for encouraging my interest in computers and technology when I was a teenager, and wouldn't those around me encouraging me to progress my careers also be responsible?

My personal feeling is that if one person and one person alone develops a piece of software with deliberate malicious intent and then without encouragment uses that code for malicious purposes, they deserve everything that is coming to them. However, if a developer puts a bug in place by accident in a routine handling safety procedures at a nuclear power plant, is it not also the responsibility of his managment, his testing team, the people who taught him how to code and how to test his code as well as his own fault that the bug got through into a production system?

Not according to Human developement report 2000

[wiZd0m]

"Fact: Highest standard of living -- Same Damn Place"

Not according to the United Nations Human developement report 2000 on this page:
http://www.undp.org/hdr2000/home.html

In this document:
http://www.undp.org/hdr2000/english/presskit/hdi .pdf

Top five:

1. Canada
2. Norway
3. United States
4. Australia
5. Iceland

Worst Five:

170. Burundi
171. Ethiopia
172. Burkina Faso
173. Niger
174. Sierra Leone

wiZd0m

Interesting Liability feedback...

[Anonymous Coward]

Surely if coders are liable for the users misuse of their programs then all writers and inventors are liable for similar misuse. Effectively this means that GunMakers and the NRA are liable for any killings that are carried out with weapons as they intended illegal usage when they created and upheld gunlaws and making weapons, and bands like Metallica are liable for kids going on killing sprees after listening to their music. KidRandom

Different liabilities: warranties and use

[TMiB]

The Salon article is interesting, but doesn't distinguish clearly enough between two very different things:
&#149 warranty for the product: should the author be liable if the software doesn't behave as it should ? (eg the GPS sending you over a cliff example in the article).
&#149 liability for third party use: eg should the authors of Gnutella or Freenet be liable if their software is used for unlawful behaviour (eg copyright infringement).

Now for the first of these, I'd like to see more liability - at least for commercial software - rather than less. Microsoft's standard licence tries real hard to avoid / limit any liability. Should a commercial vendor really be able to say it's not liable, eg, if the fact that its spreadsheet can't do math leads an individual or a business to lose money ?
(The GPL also has a no warranty provision. Dealing with non-commercial open source software shouldn't be a problem: not only is there no commercial benefit to the author, but in theory the user can look at the code themselves to see if it does what the user wants - and even change the code to suit the user's needs.)

The second gives rise to more difficult problems, and this is where Napster is fighting. (Don't forget that Napster though is providing a service - the server - so if Napster loses it won't necessarily mean that the authors of Gnutella or Freenet would lose.)
The test for a product (eg a VCR) is whether the product is "capable" of a lawful use. In the Sony case, a VCR was held to be capable of doing perfectly lawful things (eg time-shifting TV viewing).
A network sniffing tool that could be used legitimately to check vulnerabilities (so they can be closed) would seem to be OK even if it could also be used to check vulnerabilities (so they can be exploited). Though if it was developed and published with the stated aim of checking and exploiting, a court may be reluctant to accept later arguments that the author shouldn't be nailed because it could also be used to check and close .